chore(deps): bump the npm_and_yarn group across 4 directories with 18 updates by dependabot[bot] · Pull Request #32 · datolabs-io/backstage-plugins

dependabot · 2026-03-03T09:45:33Z

Bumps the npm_and_yarn group with 12 updates in the / directory:

Package	From	To
@babel/runtime	`7.26.0`	`7.28.6`
@backstage/cli-common	`0.1.15`	`0.1.18`
ajv	`6.12.6`	`6.14.0`
axios	`1.7.9`	`1.13.6`
bn.js	`4.12.1`	`4.12.3`
diff	`4.0.2`	`4.0.4`
fast-xml-parser	`4.5.1`	`4.5.4`
lodash	`4.17.21`	`4.17.23`
minimatch	`3.1.2`	`3.1.5`
pbkdf2	`3.1.2`	`3.1.5`
rollup	`4.28.1`	`4.59.0`
webpack	`5.97.1`	`5.105.3`

Bumps the npm_and_yarn group with 10 updates in the /workspaces/repo-tools directory:

Package	From	To
@babel/runtime	`7.26.0`	`7.28.6`
@backstage/cli-common	`0.1.15`	`0.1.18`
ajv	`6.12.6`	`6.14.0`
bn.js	`4.12.1`	`4.12.3`
diff	`4.0.2`	`4.0.4`
pbkdf2	`3.1.2`	`3.1.5`
qs	`6.5.3`	`6.5.5`
rollup	`4.28.1`	`4.59.0`
webpack	`5.97.1`	`5.105.3`
basic-ftp	`5.0.5`	`5.2.0`

Bumps the npm_and_yarn group with 14 updates in the /workspaces/scaffolder-backend-module-gcp directory:

Package	From	To
@babel/runtime	`7.26.0`	`7.28.6`
@backstage/cli-common	`0.1.15`	`0.1.18`
ajv	`6.12.6`	`6.14.0`
bn.js	`4.12.1`	`4.12.3`
diff	`4.0.2`	`4.0.4`
pbkdf2	`3.1.2`	`3.1.5`
qs	`6.5.3`	`6.5.5`
rollup	`4.28.1`	`4.59.0`
webpack	`5.97.1`	`5.105.3`
basic-ftp	`5.0.5`	`5.2.0`
@backstage/backend-defaults	`0.7.0`	`0.15.2`
@backstage/plugin-scaffolder-backend	`1.29.0`	`2.1.1`
@backstage/plugin-techdocs-node	`1.12.16`	`1.14.2`
multer	`1.4.5-lts.1`	`1.4.5-lts.2`

Bumps the npm_and_yarn group with 2 updates in the /workspaces/scaffolder-backend-module-gcp/packages/backend directory: @backstage/backend-defaults and @backstage/plugin-scaffolder-backend.

Updates @babel/runtime from 7.26.0 to 7.28.6

Release notes

Sourced from @babel/runtime's releases.

v7.28.6 (2026-01-12)

Thanks @kadhirash and @kolvian for your first PRs!

🐛 Bug Fix

babel-cli, babel-code-frame, babel-core, babel-helper-check-duplicate-nodes, babel-helper-fixtures, babel-helper-plugin-utils, babel-node, babel-plugin-transform-flow-comments, babel-plugin-transform-modules-commonjs, babel-plugin-transform-property-mutators, babel-preset-env, babel-traverse, babel-types

#17589 Improve Unicode handling in code-frame tokenizer (@JLHwung)

babel-plugin-transform-regenerator

#17556 fix: transform-regenerator correctly handles scope (@liuxingbaoyu)

babel-plugin-transform-react-jsx

#17538 fix: Keep jsx comments (@liuxingbaoyu)

💅 Polish

babel-core, babel-standalone

#17606 Polish(standalone): improve message on invalid preset/plugin (@JLHwung)

🏠 Internal

babel-plugin-bugfix-v8-static-class-fields-redefine-readonly, babel-plugin-proposal-decorators, babel-plugin-proposal-import-attributes-to-assertions, babel-plugin-proposal-import-wasm-source, babel-plugin-syntax-async-do-expressions, babel-plugin-syntax-decorators, babel-plugin-syntax-destructuring-private, babel-plugin-syntax-do-expressions, babel-plugin-syntax-explicit-resource-management, babel-plugin-syntax-export-default-from, babel-plugin-syntax-flow, babel-plugin-syntax-function-bind, babel-plugin-syntax-function-sent, babel-plugin-syntax-import-assertions, babel-plugin-syntax-import-attributes, babel-plugin-syntax-import-defer, babel-plugin-syntax-import-source, babel-plugin-syntax-jsx, babel-plugin-syntax-module-blocks, babel-plugin-syntax-optional-chaining-assign, babel-plugin-syntax-partial-application, babel-plugin-syntax-pipeline-operator, babel-plugin-syntax-throw-expressions, babel-plugin-syntax-typescript, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-class-properties, babel-plugin-transform-class-static-block, babel-plugin-transform-dotall-regex, babel-plugin-transform-duplicate-named-capturing-groups-regex, babel-plugin-transform-explicit-resource-management, babel-plugin-transform-exponentiation-operator, babel-plugin-transform-json-strings, babel-plugin-transform-logical-assignment-operators, babel-plugin-transform-nullish-coalescing-operator, babel-plugin-transform-numeric-separator, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-catch-binding, babel-plugin-transform-optional-chaining, babel-plugin-transform-private-methods, babel-plugin-transform-private-property-in-object, babel-plugin-transform-regexp-modifiers, babel-plugin-transform-unicode-property-regex, babel-plugin-transform-unicode-sets-regex

#17580 Allow Babel 8 in compatible Babel 7 plugins (@nicolo-ribaudo)

🏃‍♀️ Performance

babel-plugin-transform-react-jsx

#17555 perf: Use lighter traversal for jsx __source,__self (@liuxingbaoyu)

Committers: 7

Babel Bot (@babel-bot)

Eliot Pontarelli (@kolvian)

Huáng Jùnliàng (@JLHwung)

Kadhirash Sivakumar (@kadhirash)

Nicolò Ribaudo (@nicolo-ribaudo)

@liuxingbaoyu

coderaiser (@coderaiser)

v7.28.5 (2025-10-23)

Thank you @CO0Ki3, @Olexandr88, and @youthfulhps for your first PRs!

👓 Spec Compliance

babel-parser

#17446 Allow Runtime Errors for Function Call Assignment Targets (@liuxingbaoyu)

babel-helper-validator-identifier

#17501 fix: update identifier to unicode 17 (@fisker)

🐛 Bug Fix

babel-plugin-proposal-destructuring-private

#17534 Allow mixing private destructuring and rest (@CO0Ki3)

babel-parser

#17521 Improve @babel/parser error typing (@JLHwung)

#17491 fix: improve ts-only declaration parsing (@JLHwung)

babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring

... (truncated)

Commits

d7f4008 v7.28.6
35055e3 v7.28.4
ef155f5 v7.28.3
cac0ff4 v7.28.2
f68ac51 chore: Avoid CITGM errors (#17382)
baa4cb8 v7.27.6
7d06930 v7.27.4
5b9468d Reduce regenerator size more (#17287)
cb78b5b [babel 8] Do not replace global regeneratorRuntime references in regenerato...
a0690e3 Split regeneratorRuntime into multiple helpers (#17238)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @babel/runtime since your current version.

Updates @backstage/cli-common from 0.1.15 to 0.1.18

Changelog

Sourced from @backstage/cli-common's changelog.

0.1.18

Patch Changes

7455dae: Use node prefix on native imports

0.1.18-next.0

Patch Changes

7455dae: Use node prefix on native imports

Updated dependencies

@backstage/errors@1.2.7

0.1.17

Patch Changes

ae4dd5d: Move some of the symlink resolution to isChildPath

0.1.16

Patch Changes

5cfb2a4: Added new run, runOutput, and runCheck utilities to help run child processes in a safe and portable way.

c8c2329: Add proxy configuration from env-vars to create-app tasks

2bae83a: Bumped dev dependencies @types/node

0.1.16-next.2

Patch Changes

2bae83a: Bumped dev dependencies @types/node

Updated dependencies

@backstage/errors@1.2.7

0.1.16-next.1

Patch Changes

5cfb2a4: Added new run, runOutput, and runCheck utilities to help run child processes in a safe and portable way.

0.1.16-next.0

Patch Changes

c8c2329: Add proxy configuration from env-vars to create-app tasks

Commits

See full diff in compare view

Updates ajv from 6.12.6 to 6.14.0

Commits

e3af0a7 6.14.0
b552ed6 add regExp option to address $data exploit via a regular expression (CVE-2025...
72f2286 docs: update v7 info
231e52b Merge pull request #1320 from philsturgeon/patch-1
d3475fc Add spectral, an AJV util from a sponsor
413afe0 docs: v7.0.0-beta.3
11e997b update readme for v7
See full diff in compare view

Updates axios from 1.7.9 to 1.13.6

Release notes

Sourced from axios's releases.

v1.13.6

This release focuses on platform compatibility, error handling improvements, and code quality maintenance.

⚠️ Important Changes

Breaking Changes: None identified in this release.

Action Required: Users targeting React Native should verify their integration, particularly if relying on specific Blob or FormData behaviours, as improvements have been made to support these objects.

🚀 New Features

React Native Blob Support: Axios now includes support for React Native Blob objects. Thanks to @moh3n9595 for the initial implementation. (#5764)

Code Quality: Implemented prettier across the codebase and resolved associated formatting issues. (#7385)

🐛 Bug Fixes

Environment Compatibility:

Fixed module exports for React Native and Browserify environments. (#7386)

Added safe FormData detection for the WeChat Mini Program environment. (#7324)

Error Handling:

AxiosError.message is now correctly enumerable. (#7392)

AxiosError.from now correctly copies the status property from the source error, ensuring better error propagation. (#7403)

🔧 Maintenance & Chores

Dependencies: Updated the development_dependencies group (5 updates). (#7432)

Infrastructure: Migrated @rollup/plugin-babel from v5.3.1 to v6.1.0. (#7424)

Documentation: Added missing JSDoc comments to utilities. (#7427)

🌟 New Contributors

We are thrilled to welcome our new contributors! Thank you for helping improve the project:

@Gudahtt (#7386)

@ybbus (#7392)

@Shiwaangee (#7324)

@skrtheboss (#7403)

@Janaka66 (#7427)

@moh3n9595 (#5764)

@digital-wizard48 (#7424)

Full Changelog: v1.13.5...v1.13.6

v1.13.5

Release 1.13.5

Highlights

Security: Fixed a potential Denial of Service issue involving the __proto__ key in mergeConfig. (PR #7369)

Bug fix: Resolved an issue where AxiosError could be missing the status field on and after v1.13.3. (PR #7368)

Changes

Security

Fix Denial of Service via __proto__ key in mergeConfig. (PR #7369)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

1.13.3 (2026-01-20)

Bug Fixes

http2: Use port 443 for HTTPS connections by default. (#7256) (d7e6065)

interceptor: handle the error in the same interceptor (#6269) (5945e40)

main field in package.json should correspond to cjs artifacts (#5756) (7373fbf)

package.json: add 'bun' package.json 'exports' condition. Load the Node.js build in Bun instead of the browser build (#5754) (b89217e)

silentJSONParsing=false should throw on invalid JSON (#7253) (#7257) (7d19335)

turn AxiosError into a native error (#5394) (#5558) (1c6a86d)

types: add handlers to AxiosInterceptorManager interface (#5551) (8d1271b)

types: restore AxiosError.cause type from unknown to Error (#7327) (d8233d9)

unclear error message is thrown when specifying an empty proxy authorization (#6314) (6ef867e)

Features

add undefined as a value in AxiosRequestConfig (#5560) (095033c)

add automatic minor and patch upgrades to dependabot (#6053) (65a7584)

add Node.js coverage script using c8 (closes #7289) (#7294) (ec9d94e)

added copilot instructions (3f83143)

compatibility with frozen prototypes (#6265) (860e033)

enhance pipeFileToResponse with error handling (#7169) (88d7884)

types: Intellisense for string literals in a widened union (#6134) (f73474d), closes microsoft/TypeScript#33471

Reverts

Revert "fix: silentJSONParsing=false should throw on invalid JSON (#7253) (#7…" (#7298) (a4230f5), closes #7253 #7 #7298

deps: bump peter-evans/create-pull-request from 7 to 8 in the github-actions group (#7334) (2d6ad5e)

Contributors to this release

Ashvin Tiwari

Nikunj Mochi

Anchal Singh

jasonsaayman

Julian Dax

Akash Dhar Dubey

Madhumita

Tackoil

Justin Dhillon

Rudransh

WuMingDao

codenomnom

Nandan Acharya

Eric Dubé

Tibor Pilz

Gabriel Quaresma

Turadg Aleahmad

... (truncated)

Commits

7108c88 chore(release): prepare release 1.13.6 (#7446)
20a0ba3 refactor(deps): migrate @rollup/plugin-babel from v5.3.1 to v6.1.0 (#7424)
885b4af feat: support react native blob objects (#5764)
00d97b9 docs(utils): add missing JSDoc comments (#7427)
9712548 chore(deps-dev): bump the development_dependencies group across 1 directory w...
d51accb fix(core): copy status from source error in AxiosError.from (#7403)
3e30bbf chore: fix publish to only run on v1 tags
672491d fix: safe FormData detection for WeChat Mini Program (#7306) (#7324)
822e3e4 fix: make AxiosError.message property enumerable (#7392)
ef3711d feat: implement prettier and fix all issues (#7385)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for axios since your current version.

Updates bn.js from 4.12.1 to 4.12.3

Commits

See full diff in compare view

Updates diff from 4.0.2 to 4.0.4

Changelog

Sourced from diff's changelog.

v4.0.4 - January 2026

Only change from 4.0.2 is a backport of the fix to GHSA-73rr-hh4g-fpgx.

v4.0.3 (deprecated)

Accidental release - do not use.

Commits

f06f3e4 v4.0.4
0179a48 v4.0.3
4568cae Backport kpdecker/jsdiff#649
4de0ffa Backport kpdecker/jsdiff#647
See full diff in compare view

Maintainer changes

This version was pushed to npm by explodingcabbage, a new releaser for diff since your current version.

Updates fast-xml-parser from 4.5.1 to 4.5.4

Release notes

Sourced from fast-xml-parser's releases.

Summary update on all the previous releases from v4.2.4

Multiple minor fixes provided in the validator and parser

v6 is added for experimental use.

ignoreAttributes support function, and array of string or regex

Add support for parsing HTML numeric entities

v5 of the application is ESM module now. However, JS is also supported

Note: Release section in not updated frequently. Please check CHANGELOG or Tags for latest release information.

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.4.2 / 2026-03-03

support maxEntityCount option

5.4.1 / 2026-02-25

fix (#785) unpairedTag node should not have tag content

5.4.0 / 2026-02-25

migrate to fast-xml-builder

5.3.9 / 2026-02-25

support strictReservedNames

5.3.8 / 2026-02-25

support maxNestedTags

handle non-array input for XML builder when preserveOrder is true (By Angelo Coetzee)

save use of js properies

5.3.7 / 2026-02-20

fix typings for CJS (By Corentin Girard)

5.3.6 / 2026-02-14

Improve security and performance of entity processing

new options maxEntitySize, maxExpansionDepth, maxTotalExpansions, maxExpandedLength, allowedTags,tagFilter

fast return when no edtity is present

improvement replacement logic to reduce number of calls

5.3.5 / 2026-02-08

fix: Escape regex char in entity name

update strnum to 2.1.2

add missing exports in CJS typings

5.3.4 / 2026-01-30

fix: handle HTML numeric and hex entities when out of range

5.3.3 / 2025-12-12

fix #775: transformTagName with allowBooleanAttributes adds an unnecessary attribute

5.3.2 / 2025-11-14

fix for import statement for v6

5.3.1 / 2025-11-03

... (truncated)

Commits

f8d4d42 update strnum to fix parsing issues of 0 when skiplike is used
ab00cdc update package bundle for minor fixes
57c6187 Update ReadMe
caeda37 fix: emit full JSON string from CLI when no output filename specified (#710)
eadeb7e fix(performance): Update check for leaf node in saveTextToParentTag function ...
682066c Update disclaimer
280cd63 Fix null CDATA to comply with undefined behavior (#701)
See full diff in compare view

Updates lodash from 4.17.21 to 4.17.23

Commits

dec55b7 Bump main to v4.17.23 (#6088)
19c9251 fix: setCacheHas JSDoc return type should be boolean (#6071)
b5e6729 jsdoc: Add -0 and BigInt zeros to _.compact falsey values list (#6062)
edadd45 Prevent prototype pollution on baseUnset function
4879a7a doc: fix autoLink function, conversion of source links (#6056)
9648f69 chore: remove yarn.lock file (#6053)
dfa407d ci: remove legacy configuration files (#6052)
156e196 feat: add renovate setup (#6039)
933e106 ci: add pipeline for Bun (#6023)
072a807 docs: update links related to Open JS Foundation (#5968)
Additional commits viewable in compare view

Updates minimatch from 3.1.2 to 3.1.5

Commits

7bba978 3.1.5
bd25942 docs: add warning about ReDoS
1a9c27c fix partial matching of globstar patterns
1a2e084 3.1.4
ae24656 update lockfile
b100374 limit recursion for **, improve perf considerably
26ffeaa lockfile update
9eca892 lock node version to 14
00c323b 3.1.3
30486b2 update CI matrix and actions
Additional commits viewable in compare view

Updates pbkdf2 from 3.1.2 to 3.1.5

Changelog

Sourced from pbkdf2's changelog.

v3.1.5 - 2025-09-23

Commits

[Fix] only allow finite iterations 67bd94d

[Fix] restore node 0.10 support 8f59d96

[Fix] check parameters before the "no Promise" bailout d2dc5f0

v3.1.4 - 2025-09-22

Commits

[Deps] update create-hash, ripemd160, sha.js, to-buffer 8dbf49b

[meta] update repo URLs d15bc35

[Dev Deps] update @ljharb/eslint-config aaf870b

v3.1.3 - 2025-06-20

Commits

Only apps should have lockfiles 8b06730

[lint] fix whitespace 9a76e2f

[lint] fix parens/curlies/semis/etc 6fd84bf

[meta] add auto-changelog 796c38d

[Tests] fix tests in node 17 3661fb0

Revert "[Tests] fix tests in node < 3" 7431b57

[Tests] fix tests in node < 3 eb9f97a

[Fix] ensure unknown algorithms throw + known ones match node 26d4fd3

[Tests] add GHA, always run nyc 513906a

[lint] fix a few more rules ab04da8

[lint] switch to eslint 89694cf

[Tests] add coverage d0d534b

[Refactor] use to-buffer e3102a8

[readme] improve badges fca0c9d

[Tests] remove unused travis file a2c7d93

[meta] switch from files to npmignore 7f31fbc

[Tests] use .nycrc 8d628e8

[Refactor] minor tweaks fc61005

[Deps] update create-hmac, safe-buffer, sha.js ae2a7d0

[Fix] pin create-hash, ripemd160 due to breaking changes e079968

[Tests] fix tests in node 3 45fbcf3

[meta] skip publishing benchmarks 19ea57b

[Dev Deps] add missing peer dep 645e252

Commits

3687905 v3.1.5
67bd94d [Fix] only allow finite iterations
8f59d96 [Fix] restore node 0.10 support
d2dc5f0 [Fix] check parameters before the "no Promise" bailout
b2ad615 v3.1.4
8dbf49b [Deps] update create-hash, ripemd160, sha.js, to-buffer
aaf870b [Dev Deps] update @ljharb/eslint-config
d15bc35 [meta] update repo URLs
3e40827 v3.1.3
e3102a8 [Refactor] use to-buffer
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ljharb, a new releaser for pbkdf2 since your current version.

Updates rollup from 4.28.1 to 4.59.0

Release notes

Sourced from rollup's releases.

v4.59.0

4.59.0

2026-02-22

Features

Throw when the generated bundle contains paths that would leave the output directory (#6276)

Pull Requests

#6275: Validate bundle stays within output dir (@lukastaegert)

v4.58.0

4.58.0

2026-02-20

Features

Also support __NO_SIDE_EFFECTS__ annotation before variable declarations declaring function expressions (#6272)

Pull Requests

#6256: docs: document PreRenderedChunk properties including isDynamicEntry and isImplicitEntry (@njg7194, @lukastaegert)

#6259: docs: Correct typo and improve sentence structure in docs for output.experimentalMinChunkSize (@millerick, @lukastaegert)

#6260: fix(deps): update rust crate swc_compiler_base to v47 (@renovate[bot], @lukastaegert)

#6261: fix(deps): lock file maintenance minor/patch updates (@renovate[bot], @lukastaegert)

#6262: Avoid unnecessary cloning of the code string (@lukastaegert)

#6263: fix(deps): update minor/patch updates (@renovate[bot], @lukastaegert)

#6265: chore(deps): lock file maintenance (@renovate[bot])

#6267: fix(deps): update minor/patch updates (@renovate[bot])

#6268: chore(deps): update dependency eslint-plugin-unicorn to v63 (@renovate[bot], @lukastaegert)

#6269: chore(deps): update dependency lru-cache to v11 (@renovate[bot])

#6270: chore(deps): lock file maintenance (@renovate[bot])

#6272: forward NO_SIDE_EFFECTS annotations to function expressions in variable declarations (@lukastaegert)

v4.57.1

4.57.1

2026-01-30

Bug Fixes

Fix heap corruption issue in Windows (#6251)

Ensure exports of a dynamic import are fully included when called from a try...catch (#6254)

Pull Requests

#6251: fix: Isolate and cache process.report.getReport() calls in a child process for robust environment detection (@alan-agius4, @lukastaegert)

... (truncated)

Changelog

Sourced from rollup's changelog.

4.59.0

2026-02-22

Features

Throw when the generated bundle contains paths that would leave the output directory (#6276)

Pull Requests

#6275: Validate bundle stays within output dir (@lukastaegert)

4.58.0

2026-02-20

Features

Also support __NO_SIDE_EFFECTS__ annotation before variable declarations declaring function expressions (#6272)

Pull Requests

#6256: docs: document PreRenderedChunk properties including isDynamicEntry and isImplicitEntry (@njg7194, @lukastaegert)

#6259: docs: Correct typo and improve sentence structure in docs for output.experimentalMinChunkSize (@millerick, @lukastaegert)

#6260: fix(deps): update rust crate swc_compiler_base to v47 (@renovate[bot], @lukastaegert)

#6261: fix(deps): lock file maintenance minor/patch updates (@renovate[bot], @lukastaegert)

#6262: Avoid unnecessary cloning of the code string (@lukastaegert)

#6263: fix(deps): update minor/patch updates (@renovate[bot], @lukastaegert)

#6265: chore(deps): lock file maintenance (@renovate[bot])

#6267: fix(deps): update minor/patch updates (@renovate[bot])

#6268: chore(deps): update dependency eslint-plugin-unicorn to v63 (@renovate[bot], @lukastaegert)

#6269: chore(deps): update dependency lru-cache to v11 (@renovate[bot])

#6270: chore(deps): lock file maintenance (@renovate[bot])

#6272: forward NO_SIDE_EFFECTS annotations to function expressions in variable declarations (@lukastaegert)

4.57.1

2026-01-30

Bug Fixes

Fix heap corruption issue in Windows (#6251)

Ensure exports of a dynamic import are fully included when called from a try...catch (#6254)

Pull Requests

#6251: fix: Isolate and cache process.report.getReport() calls in a child process for robust environment detection (@alan-agius4, @lukastaegert)

#6252: chore(deps): update dependency lru-cache to v11 (@renovate[bot])

#6253: chore(deps): lock file maintenance minor/patch updates (@renovate[bot], @lukastaegert)

#6254: Fully include dynamic imports in a try-catch (@lukastaegert)

... (truncated)

Commits

ae84695 4.59.0
b39616e Update audit-resolve
c60770d Validate bundle stays within output dir (#6275)
33f39c1 4.58.0
b61c408 forward NO_SIDE_EFFECTS annotations to function expressions in variable decla...
7f00689 Extend agent instructions
e7b2b85 chore(deps): lock file maintenance (#6270)
2aa5da9 fix(deps): update minor/patch updates (#6267)
4319837 chore(deps): update dependency lru-cache to v11 (#6269)
c3b6b4b chore(deps): update dependency eslint-plugin-unicorn to v63 (#6268)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for rollup since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates webpack from 5...

Description has been truncated

… updates Bumps the npm_and_yarn group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@babel/runtime](https://github.com/babel/babel/tree/HEAD/packages/babel-runtime) | `7.26.0` | `7.28.6` | | [@backstage/cli-common](https://github.com/backstage/backstage/tree/HEAD/packages/cli-common) | `0.1.15` | `0.1.18` | | [ajv](https://github.com/ajv-validator/ajv) | `6.12.6` | `6.14.0` | | [axios](https://github.com/axios/axios) | `1.7.9` | `1.13.6` | | [bn.js](https://github.com/indutny/bn.js) | `4.12.1` | `4.12.3` | | [diff](https://github.com/kpdecker/jsdiff) | `4.0.2` | `4.0.4` | | [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `4.5.1` | `4.5.4` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.17.23` | | [minimatch](https://github.com/isaacs/minimatch) | `3.1.2` | `3.1.5` | | [pbkdf2](https://github.com/browserify/pbkdf2) | `3.1.2` | `3.1.5` | | [rollup](https://github.com/rollup/rollup) | `4.28.1` | `4.59.0` | | [webpack](https://github.com/webpack/webpack) | `5.97.1` | `5.105.3` | Bumps the npm_and_yarn group with 10 updates in the /workspaces/repo-tools directory: | Package | From | To | | --- | --- | --- | | [@babel/runtime](https://github.com/babel/babel/tree/HEAD/packages/babel-runtime) | `7.26.0` | `7.28.6` | | [@backstage/cli-common](https://github.com/backstage/backstage/tree/HEAD/packages/cli-common) | `0.1.15` | `0.1.18` | | [ajv](https://github.com/ajv-validator/ajv) | `6.12.6` | `6.14.0` | | [bn.js](https://github.com/indutny/bn.js) | `4.12.1` | `4.12.3` | | [diff](https://github.com/kpdecker/jsdiff) | `4.0.2` | `4.0.4` | | [pbkdf2](https://github.com/browserify/pbkdf2) | `3.1.2` | `3.1.5` | | [qs](https://github.com/ljharb/qs) | `6.5.3` | `6.5.5` | | [rollup](https://github.com/rollup/rollup) | `4.28.1` | `4.59.0` | | [webpack](https://github.com/webpack/webpack) | `5.97.1` | `5.105.3` | | [basic-ftp](https://github.com/patrickjuchli/basic-ftp) | `5.0.5` | `5.2.0` | Bumps the npm_and_yarn group with 14 updates in the /workspaces/scaffolder-backend-module-gcp directory: | Package | From | To | | --- | --- | --- | | [@babel/runtime](https://github.com/babel/babel/tree/HEAD/packages/babel-runtime) | `7.26.0` | `7.28.6` | | [@backstage/cli-common](https://github.com/backstage/backstage/tree/HEAD/packages/cli-common) | `0.1.15` | `0.1.18` | | [ajv](https://github.com/ajv-validator/ajv) | `6.12.6` | `6.14.0` | | [bn.js](https://github.com/indutny/bn.js) | `4.12.1` | `4.12.3` | | [diff](https://github.com/kpdecker/jsdiff) | `4.0.2` | `4.0.4` | | [pbkdf2](https://github.com/browserify/pbkdf2) | `3.1.2` | `3.1.5` | | [qs](https://github.com/ljharb/qs) | `6.5.3` | `6.5.5` | | [rollup](https://github.com/rollup/rollup) | `4.28.1` | `4.59.0` | | [webpack](https://github.com/webpack/webpack) | `5.97.1` | `5.105.3` | | [basic-ftp](https://github.com/patrickjuchli/basic-ftp) | `5.0.5` | `5.2.0` | | [@backstage/backend-defaults](https://github.com/backstage/backstage/tree/HEAD/packages/backend-defaults) | `0.7.0` | `0.15.2` | | [@backstage/plugin-scaffolder-backend](https://github.com/backstage/backstage/tree/HEAD/plugins/scaffolder-backend) | `1.29.0` | `2.1.1` | | [@backstage/plugin-techdocs-node](https://github.com/backstage/backstage/tree/HEAD/plugins/techdocs-node) | `1.12.16` | `1.14.2` | | [multer](https://github.com/expressjs/multer) | `1.4.5-lts.1` | `1.4.5-lts.2` | Bumps the npm_and_yarn group with 2 updates in the /workspaces/scaffolder-backend-module-gcp/packages/backend directory: [@backstage/backend-defaults](https://github.com/backstage/backstage/tree/HEAD/packages/backend-defaults) and [@backstage/plugin-scaffolder-backend](https://github.com/backstage/backstage/tree/HEAD/plugins/scaffolder-backend). Updates `@babel/runtime` from 7.26.0 to 7.28.6 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.28.6/packages/babel-runtime) Updates `@backstage/cli-common` from 0.1.15 to 0.1.18 - [Release notes](https://github.com/backstage/backstage/releases) - [Changelog](https://github.com/backstage/backstage/blob/master/packages/cli-common/CHANGELOG.md) - [Commits](https://github.com/backstage/backstage/commits/HEAD/packages/cli-common) Updates `ajv` from 6.12.6 to 6.14.0 - [Release notes](https://github.com/ajv-validator/ajv/releases) - [Commits](ajv-validator/ajv@v6.12.6...v6.14.0) Updates `axios` from 1.7.9 to 1.13.6 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.7.9...v1.13.6) Updates `bn.js` from 4.12.1 to 4.12.3 - [Release notes](https://github.com/indutny/bn.js/releases) - [Changelog](https://github.com/indutny/bn.js/blob/master/CHANGELOG.md) - [Commits](https://github.com/indutny/bn.js/commits/v4.12.3) Updates `diff` from 4.0.2 to 4.0.4 - [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md) - [Commits](kpdecker/jsdiff@v4.0.2...v4.0.4) Updates `fast-xml-parser` from 4.5.1 to 4.5.4 - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-parser@v4.5.1...v4.5.4) Updates `lodash` from 4.17.21 to 4.17.23 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.17.23) Updates `minimatch` from 3.1.2 to 3.1.5 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.1.2...v3.1.5) Updates `pbkdf2` from 3.1.2 to 3.1.5 - [Changelog](https://github.com/browserify/pbkdf2/blob/master/CHANGELOG.md) - [Commits](browserify/pbkdf2@v3.1.2...v3.1.5) Updates `rollup` from 4.28.1 to 4.59.0 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.28.1...v4.59.0) Updates `webpack` from 5.97.1 to 5.105.3 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.97.1...v5.105.3) Updates `@babel/runtime` from 7.26.0 to 7.28.6 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.28.6/packages/babel-runtime) Updates `@backstage/cli-common` from 0.1.15 to 0.1.18 - [Release notes](https://github.com/backstage/backstage/releases) - [Changelog](https://github.com/backstage/backstage/blob/master/packages/cli-common/CHANGELOG.md) - [Commits](https://github.com/backstage/backstage/commits/HEAD/packages/cli-common) Updates `ajv` from 6.12.6 to 6.14.0 - [Release notes](https://github.com/ajv-validator/ajv/releases) - [Commits](ajv-validator/ajv@v6.12.6...v6.14.0) Updates `bn.js` from 4.12.1 to 4.12.3 - [Release notes](https://github.com/indutny/bn.js/releases) - [Changelog](https://github.com/indutny/bn.js/blob/master/CHANGELOG.md) - [Commits](https://github.com/indutny/bn.js/commits/v4.12.3) Updates `diff` from 4.0.2 to 4.0.4 - [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md) - [Commits](kpdecker/jsdiff@v4.0.2...v4.0.4) Updates `pbkdf2` from 3.1.2 to 3.1.5 - [Changelog](https://github.com/browserify/pbkdf2/blob/master/CHANGELOG.md) - [Commits](browserify/pbkdf2@v3.1.2...v3.1.5) Updates `qs` from 6.5.3 to 6.5.5 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.5.3...v6.5.5) Updates `rollup` from 4.28.1 to 4.59.0 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.28.1...v4.59.0) Updates `webpack` from 5.97.1 to 5.105.3 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.97.1...v5.105.3) Updates `basic-ftp` from 5.0.5 to 5.2.0 - [Release notes](https://github.com/patrickjuchli/basic-ftp/releases) - [Changelog](https://github.com/patrickjuchli/basic-ftp/blob/master/CHANGELOG.md) - [Commits](patrickjuchli/basic-ftp@v5.0.5...v5.2.0) Updates `@babel/runtime` from 7.26.0 to 7.28.6 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.28.6/packages/babel-runtime) Updates `@backstage/cli-common` from 0.1.15 to 0.1.18 - [Release notes](https://github.com/backstage/backstage/releases) - [Changelog](https://github.com/backstage/backstage/blob/master/packages/cli-common/CHANGELOG.md) - [Commits](https://github.com/backstage/backstage/commits/HEAD/packages/cli-common) Updates `ajv` from 6.12.6 to 6.14.0 - [Release notes](https://github.com/ajv-validator/ajv/releases) - [Commits](ajv-validator/ajv@v6.12.6...v6.14.0) Updates `bn.js` from 4.12.1 to 4.12.3 - [Release notes](https://github.com/indutny/bn.js/releases) - [Changelog](https://github.com/indutny/bn.js/blob/master/CHANGELOG.md) - [Commits](https://github.com/indutny/bn.js/commits/v4.12.3) Updates `diff` from 4.0.2 to 4.0.4 - [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md) - [Commits](kpdecker/jsdiff@v4.0.2...v4.0.4) Updates `pbkdf2` from 3.1.2 to 3.1.5 - [Changelog](https://github.com/browserify/pbkdf2/blob/master/CHANGELOG.md) - [Commits](browserify/pbkdf2@v3.1.2...v3.1.5) Updates `qs` from 6.5.3 to 6.5.5 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.5.3...v6.5.5) Updates `rollup` from 4.28.1 to 4.59.0 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.28.1...v4.59.0) Updates `webpack` from 5.97.1 to 5.105.3 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.97.1...v5.105.3) Updates `basic-ftp` from 5.0.5 to 5.2.0 - [Release notes](https://github.com/patrickjuchli/basic-ftp/releases) - [Changelog](https://github.com/patrickjuchli/basic-ftp/blob/master/CHANGELOG.md) - [Commits](patrickjuchli/basic-ftp@v5.0.5...v5.2.0) Updates `@backstage/backend-defaults` from 0.7.0 to 0.15.2 - [Release notes](https://github.com/backstage/backstage/releases) - [Changelog](https://github.com/backstage/backstage/blob/master/packages/backend-defaults/CHANGELOG.md) - [Commits](https://github.com/backstage/backstage/commits/HEAD/packages/backend-defaults) Updates `@backstage/plugin-scaffolder-backend` from 1.29.0 to 2.1.1 - [Release notes](https://github.com/backstage/backstage/releases) - [Changelog](https://github.com/backstage/backstage/blob/master/plugins/scaffolder-backend/CHANGELOG.md) - [Commits](https://github.com/backstage/backstage/commits/HEAD/plugins/scaffolder-backend) Updates `@backstage/plugin-techdocs-node` from 1.12.16 to 1.14.2 - [Release notes](https://github.com/backstage/backstage/releases) - [Changelog](https://github.com/backstage/backstage/blob/master/plugins/techdocs-node/CHANGELOG.md) - [Commits](https://github.com/backstage/backstage/commits/v1.14.2/plugins/techdocs-node) Updates `multer` from 1.4.5-lts.1 to 1.4.5-lts.2 - [Release notes](https://github.com/expressjs/multer/releases) - [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md) - [Commits](expressjs/multer@v1.4.5-lts.1...v1.4.5-lts.2) Updates `@backstage/backend-defaults` from 0.7.0 to 0.15.2 - [Release notes](https://github.com/backstage/backstage/releases) - [Changelog](https://github.com/backstage/backstage/blob/master/packages/backend-defaults/CHANGELOG.md) - [Commits](https://github.com/backstage/backstage/commits/HEAD/packages/backend-defaults) Updates `@backstage/plugin-scaffolder-backend` from 1.33.0 to 3.1.3 - [Release notes](https://github.com/backstage/backstage/releases) - [Changelog](https://github.com/backstage/backstage/blob/master/plugins/scaffolder-backend/CHANGELOG.md) - [Commits](https://github.com/backstage/backstage/commits/HEAD/plugins/scaffolder-backend) --- updated-dependencies: - dependency-name: "@babel/runtime" dependency-version: 7.28.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@backstage/cli-common" dependency-version: 0.1.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ajv dependency-version: 6.14.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.13.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: bn.js dependency-version: 4.12.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: diff dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-xml-parser dependency-version: 4.5.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.17.23 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: pbkdf2 dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 4.59.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: webpack dependency-version: 5.105.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@babel/runtime" dependency-version: 7.28.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@backstage/cli-common" dependency-version: 0.1.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ajv dependency-version: 6.14.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: bn.js dependency-version: 4.12.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: diff dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: pbkdf2 dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.5.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 4.59.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: webpack dependency-version: 5.105.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: basic-ftp dependency-version: 5.2.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@babel/runtime" dependency-version: 7.28.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@backstage/cli-common" dependency-version: 0.1.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ajv dependency-version: 6.14.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: bn.js dependency-version: 4.12.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: diff dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: pbkdf2 dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.5.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 4.59.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: webpack dependency-version: 5.105.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: basic-ftp dependency-version: 5.2.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@backstage/backend-defaults" dependency-version: 0.15.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@backstage/plugin-scaffolder-backend" dependency-version: 2.1.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@backstage/plugin-techdocs-node" dependency-version: 1.14.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: multer dependency-version: 1.4.5-lts.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@backstage/backend-defaults" dependency-version: 0.15.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@backstage/plugin-scaffolder-backend" dependency-version: 3.1.3 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot requested a review from a team as a code owner March 3, 2026 09:45

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 3, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the npm_and_yarn group across 4 directories with 18 updates#32

chore(deps): bump the npm_and_yarn group across 4 directories with 18 updates#32
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-9395ea708d

dependabot bot commented on behalf of github Mar 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot bot commented on behalf of github Mar 3, 2026

v7.28.6 (2026-01-12)

🐛 Bug Fix

💅 Polish

🏠 Internal

🏃‍♀️ Performance

Committers: 7

v7.28.5 (2025-10-23)

👓 Spec Compliance

🐛 Bug Fix

0.1.18

Patch Changes

0.1.18-next.0

Patch Changes

0.1.17

Patch Changes

0.1.16

Patch Changes

0.1.16-next.2

Patch Changes

0.1.16-next.1

Patch Changes

0.1.16-next.0

Patch Changes

v1.13.6

⚠️ Important Changes

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.13.5

Release 1.13.5

Highlights

Changes

Security

Changelog

1.13.3 (2026-01-20)

Bug Fixes

Features

Reverts

Contributors to this release

v4.0.4 - January 2026

v4.0.3 (deprecated)

Summary update on all the previous releases from v4.2.4

v3.1.5 - 2025-09-23

Commits

v3.1.4 - 2025-09-22

Commits

v3.1.3 - 2025-06-20

Commits

v4.59.0

4.59.0

Features

Pull Requests

v4.58.0

4.58.0

Features

Pull Requests

v4.57.1

4.57.1

Bug Fixes

Pull Requests

4.59.0

Features

Pull Requests

4.58.0

Features

Pull Requests

4.57.1

Bug Fixes

Pull Requests

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development